Symantec Endpoint Protection Manager - Multiple errors: An unexpected exception has occurred

Products

• Endpoint Protection

Issue/Introduction

You face multiple times Unexpected Exception error while logged in the SEPM

Reviewing the logs you find the following:

Scm-server log

SEVERE: Unknown Exception in: com.sygate.scm.server.task.ExternalLoggingWorker
java.lang.NullPointerException
at com.sygate.scm.server.configmanager.GroupManager.retrieveGroupById(GroupManager.java:123)
at com.sygate.scm.server.configmanager.GroupManager.getGroupFullPath(GroupManager.java:1081)
at com.sygate.scm.server.task.ExternalLoggingWorker.getGroupFullPath(ExternalLoggingWorker.java:1197)
at com.sygate.scm.server.task.ExternalLoggingWorker.getLogData(ExternalLoggingWorker.java:1722)
at com.sygate.scm.server.task.ExternalLoggingWorker.handleLog(ExternalLoggingWorker.java:648)
at com.sygate.scm.server.task.ExternalLoggingWorker.run(ExternalLoggingWorker.java:431)
at java.base/java.util.TimerThread.mainLoop(Timer.java:556)
at java.base/java.util.TimerThread.run(Timer.java:506) {panel}

ExternalLoggingTask log

WARNING: prepareTopLevelObject >> metadata is null 
FINEST: getTopLevelObject >> Not found from cache, queried from DB for guid: xxxxxxxxxxxxxxxxxxxx, result is null?: true
FINE:  calling close on connection.

Environment

SEPM 14.3 RU9

Cause

Our analysis has identified that the errors are caused by the system attempting to process and export scan logs that are associated with a previously deleted domain.

Resolution

As a temporary workaround, you can disable the "Scan" log type from being exported to your external logging server.
A permanent fix that prevents this issue from happening in the future is under evaluation. This KB will be updated when there will be any updates on the permanent solution.

The Technical Support can also provide a database script that will clean up these old log entries and stop the errors from occurring.